Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118938— Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

Quick assessment

Affected
trailofbits fickling
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Trail of Bits 开发的 fickling 0.1.12 版本中，存在一个漏洞：当 pickle 的 操作数携带带点号的 （例如 ）时，pickle 的 函数会通过 将其解析为任意属性路径，而非模块级函数。fickling 仅在其导入跟踪中记录名称的起始组件，并将该操作渲染为普通导入（例如，运行 时显示为 ），因此尾部的属性引用从未被分析为函数调用。OvertlyBadEvals 分析阶段未能标记此行为，且 返回 （可能安全），且无任何发现。这使得攻击者能够访问一个执行代码的类方法： 会执行 ，从而在

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118938

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
Source: CVE Program / CVE List V5
Vulnerability Description
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, 'python -m fickling' displays it as 'from optparse import Values.read_file'), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor's October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用不正确的解析名称或索引
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
trailofbits fickling 0 ~ 0.1.12 -

II. Public POCs for CVE-2026-118938

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118938

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118938 (1)

Vendor Advisories for CVE-2026-118938 (1)

Proof of Concept for CVE-2026-118938 (1)

Other References for CVE-2026-118938 (1)

IV. Related Vulnerabilities

Same product: fickling
Same vendor: trailofbits
Same weakness: CWE-706